CodeVetter · Repo Unpack · Risk map
spf13/cobra
These findings are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include evaluated shell requests, caller-selected file destinations, environment-controlled logging, and process termination. Mutable command and global state also couples otherwise separate uses of the library. Actual exploitability and downstream application security were not tested.
- Generated Bash requests use eval, PowerShell uses Invoke-Expression, and Fish escapes arguments before eval; hypothesis: quoting regressions at these boundaries could reinterpret shell input and need shell-specific reproduction. (inferred)
- CompDebug accepts BASH_COMP_DEBUG_FILE as an unrestricted destination and opens it with append/create/write flags and mode 0644; open failures are ignored, while write errors flow through CheckErr.
- Documentation and completion-file APIs use os.Create on caller-selected paths, which permits overwriting existing files; tree generation can leave earlier descendant files written when a later step fails.
- Normal pre-hooks run before required-flag and flag-group validation; RunE errors bypass command post-hooks, whereas deferred global finalizers are already installed after preRun.
- Template functions, initializer/finalizer lists, and execution switches are package-global mutable state without synchronization in their setters; completion callback registration separately uses an RWMutex.
- Legacy Bash generation iterates the global callback registry and rewrites each registered flag's BashCompCustom annotation using the current command's root name, including flags outside that command tree.
- Completion group enforcement mutates required annotations and Hidden flags; YAML genFlagResult visits all flags without the hidden/deprecated filtering implemented by manPrintFlags.
- Malformed custom templates can panic through template.Must, missing group IDs panic during ExecuteC, and YAML marshal failure or CheckErr can terminate the embedding process.